Trust has become more and more important as the computing industry continues to grow. Mobile computing devices, such as notebook personal computers (PCs), personal data assistants (PDAs), and other devices are now common accessories used in day-to-day business and personal activities. With this growth, there is a need to make these platforms more trustworthy. Due to the ease of transport, mobile platforms are more and more susceptible to theft. In many cases, stolen data is regarded as being more valuable than the platform hardware. Accordingly, it has become imperative to protect user data and secrets in the mobile computing field.
The Trusted Computing Group (TCG) was formed to encourage industry participation in the development and adoption of an open specification for an improved computing platform. The TCG participants agreed that the specification for a trusted computing platform should focus on ensuring privacy and enhancing security. The TCG developed mechanisms which are intended to provide increased confidence and enable enhancements of existing services as well as the provision of new services. The “Trusted Platform Module” (TPM) is intended to “report” the integrity of a platform. This allows an external resource (e.g., a server on a network) to determine the trustworthiness of the platform but does not prevent access to the platform by the user.
The TPM can be described as a secure micro-controller with added cryptographic functionalities. The TPM includes various functions, storage locations, and a number of trust-related capabilities. The SEAL capability is used to ensure that data protected by a single TPM is only available on the same TPM. Currently, the TPM only releases the sealed data based on values contained in platform configuration registers (PCRs). The sealed data contains one or more expected PCR values and the TPM mechanism ensures the release of the data only when expected PCR values match the current PCR values in the TPM. However, the TPM has no way to further restrict the use of the sealed data.